Powerful CI/CD for DevOps-centric teams

News Security

Summary

In October 2026, the private keys of eight intermediate certificate authorities operated by eMudhra were found to be weak and recoverable from public data. According to eMudhra’s official statement, none of the affected intermediate CAs had issued end-entity (leaf) certificates, and eMudhra is not aware of evidence that the weak keys were recovered or exploited before the issue was disclosed.

The issue is not a vulnerability in TeamCity itself. However, the trust stores maintained by other software components (primarily the Java runtime) that TeamCity relies on may continue to trust the compromised certificates. Starting with versions 2026.2.2 and 2026.1.6, TeamCity shows a health report if the installation still trusts affected certificates, along with remediation steps.

Recommended actions:

TeamCity On-Premises: Review server and build agent installations and apply the necessary fixes according to the instructions below. Upgrade to v2026.2.2 or v2026.1.6 for an updated Java runtime for the Windows agent installer, updated Docker images, and the health report, or follow the instructions below to apply the same fixes to the current installation.
TeamCity Cloud: TeamCity Cloud has already been updated. Certificates uploaded to TeamCity must be reviewed as described in Certificates uploaded to TeamCity below. Self-hosted build agents must also be reviewed according to the instructions below.

Details

On October 17, 2026, the private keys of eight eMudhra intermediate CAs, six for TLS and two for code signing, were reported as compromised. This is an industry-wide certificate authority incident, not an issue specific to TeamCity. Certificates issued with these keys would look valid to any software that still trusts them.

Browser and OS vendors have released updates that block the compromised certificates, and systems are protected once they install them. Software with its own trust store, such as a Java runtime, keeps trusting the compromised certificates until that trust store is updated. TeamCity’s server and build agents use the trust store of their Java runtime.

TeamCity downloads are not signed by an eMudhra CA and are not affected.

What you need to do

1. Update the Java runtime

Identify the Java runtime used by each server node and agent, including any custom trust store set with javax.net.ssl.trustStore.
Check the Java vendor’s release notes for CVE-2026-91403 and CVE-2026-114820. For Amazon Corretto 21, the fixed build is 21.0.13.0.11 or later.
Update affected runtimes and restart each server node or agent.

Optional trust-store verification can identify affected certificates still present in a trust store. If upgrading is not feasible, follow the manual mitigation commands in the same section.

Removing AAA Certificate Services can disrupt unaffected services; test dependent connections before removing that root.

2. Update your TeamCity server and review uploaded certificates

The following server maintenance recommendations apply to TeamCity On-Premises installations. JetBrains patches TeamCity Cloud, but certificates uploaded to the service still require review.

Upgrade TeamCity if possible. Releases 2026.2.2 and 2026.1.6 add the health report, other product improvements, and fixes for other vulnerabilities. Existing agents require an independent review.
Update Java on every server node. Follow Update the Java runtime, even after upgrading TeamCity.
Redeploy Docker installations. Pull the patched 2026.2.2 or 2026.1.6 server image from Docker Hub once published, or rebuild the existing image using the server image instructions. Recreate the containers.
Review uploaded certificates. Use the health report or the certificate inspection commands below and then remove affected certificates through the Root project’s SSL / HTTPS Certificates page. Updating Java does not remove uploaded certificates.

Updating the TeamCity server does not update integrations or third-party software. Review those components separately as described in Review and update supporting infrastructure.

3. Update your TeamCity agents and review trusted certificates

Update Java on every build agent. Follow Update the Java runtime. TeamCity Cloud customers must also review the Java runtimes used by their self-hosted agents. The health report does not check agents.
Update Docker installations. Pull the patched 2026.2.2 or 2026.1.6 agent image from Docker Hub. Alternatively, rebuild the existing image using the same rebuild instructions as for the server image. Recreate the containers using the updated image.
Review agent certificates. Run the certificate inspection commands under Technical commands from <agent home>/conf/trustedCertificates and remove any affected certificate files. Updating Java does not remove these certificates.

4. Review and update supporting infrastructure

Updating the server does not update integrations or third-party software. We recommend reviewing these components independently:

Operating systems and build tools: Apply vendor updates to OS trust stores, other Java runtimes, Git and MinGit, Python’s certifi, Node.js, and other tools with separate trust stores.
Custom images: Update the OS and tools inside each affected image, rebuild the image, and recreate the containers.
Connected services: Replace eMudhra certificates used by VCS hosts, package registries, and other services through eMudhra’s migration process.

Technical commands

Each script defines its environment variables at the top:

TEAMCITY_JRE: Defaults to JAVA_HOME; change it if TeamCity runs on another JRE or JDK.
TC_TRUSTSTORE: Set to any custom javax.net.ssl.trustStore (JDK 8 default: jre/lib/security/cacerts).
TC_STOREPASS: Change it if the password differs.
TC_CERT_DIR: The certificate file to inspect, where indicated.

Optional trust-store verification

Please note the result applies only to the selected trust store. The commands do not inspect blocked.certs.

Linux and macOS (Bash or zsh):

Windows (PowerShell):

Certificates uploaded to TeamCity

The health report in versions 2026.2.2 and 2026.1.6 lists affected server certificates. For manual inspection, check custom certificates and identify the affected ones.

Set path to the directory with custom certificates (TC_CERT_DIR) to the following and run the command:

Server: <TeamCity Data Directory>/config/projects/_Root/pluginData/trustedCertificates
Agent: <agent home>/conf/trustedCertificates

Linux and macOS (Bash or zsh):

Windows (PowerShell):

Manual mitigation commands

Before execution, make sure TEAMCITY_JRE in the current terminal points to the runtime actually running the TeamCity component:

Server: Consult this configuration reference.
Agents: Check teamcity.agent.jvm.java.home on the agent’s Parameters tab, as described in the Java Update Guide.
Copy lib/security/blocked.certs from a JDK containing the fix for CVE-2026-91403 to the same location in the runtime in use. Java 8 uses jre/lib/security/blacklisted.certs, while some Java 11 and 13 builds also use blacklisted.certs, so verify the path before copying.
Back up the trust store. Removing AAA Certificate Services can disrupt unaffected services; test dependent connections first.
Run the command below. It uses the same script header as the verification commands above, finds the affected roots listed above by fingerprint, and deletes them. Running it again is safe.

Linux and macOS (Bash or zsh):

Windows (PowerShell):

Afterwards, run the verification commands above to confirm the roots are gone. Restart the server node or agent after completing the mitigation. Include any custom trust stores in the review.

Security Bulletin

JetBrains’ assessment and guidance on the eMudhra Certificate Authority incident is available here.

Frequently asked questions

Is TeamCity affected?

Not directly. As a CI/CD system, TeamCity connects to multiple integrations and relies on Java runtimes, build tools, and other components with separate trust stores. These trust stores require independent review and updates, as described in What you need to do.

Do I need to upgrade?

Upgrading to 2026.2.2 or 2026.1.6 is recommended. These releases add the health report, other product improvements, and fixes for other vulnerabilities.

Upgrading TeamCity does not always update Java, so review the corresponding runtime using the Optional trust-store verification section above. If upgrading TeamCity is not currently an option, apply the mitigations described in If upgrading is not feasible above.

Is TeamCity Cloud affected?

TeamCity Cloud has already been updated, but customers must still check:

Self-hosted agents using TeamCity Agents, as described above.
Certificates uploaded to TeamCity, as described above.

Does the health report check build agents?

No. The health report checks the server nodes only. Check and fix build agents manually, as described in TeamCity Agents above.

Which TeamCity Docker images are affected?

Images for versions 2026.2.2 and 2026.1.6 are patched, so please update if possible. Older images can be patched as described in TeamCity Server and TeamCity Agents above, and then used to recreate the containers.

Support

For any questions regarding this issue, please get in touch with the TeamCity Support team by submitting a ticket. To report a security issue in TeamCity, please follow our Coordinated Disclosure Policy.